fix: select RXTX channel by firmware family

src/ppclock/protocol.py

@@ -10,11 +10,25 @@ EPD_CHAR_UUID = "4b646063-6264-f3a7-8941-e65356ea82fe"
 RXTX_SERVICE_UUID = "00001f10-0000-1000-8000-00805f9b34fb"
 RXTX_CHAR_UUID = "0000331f-0000-1000-8000-00805f9b34fb"  # 活命令通道(h=57, notify+write+read)
 RXTX_CHAR_UUID_LEGACY = "00001f1f-0000-1000-8000-00805f9b34fb"  # h=53 仅write，本设备不执行命令
+FIRMWARE_REVISION_UUID = "00002a26-0000-1000-8000-00805f9b34fb"
 DEVICE_NAME_PREFIX = "NRF-"
 
 BLOCK_PAYLOAD = 240  # my_step=480 hex 字符 = 240 数据字节
 COMMIT = 0xE2
 
+
+def select_rxtx_uuid(firmware_revision: str | None) -> str:
+    """按固件家族选择控制特征。
+
+    PP 4.2 实机的 1F1F 虽可写但不执行控制命令，活通道是 331F；
+    HM42_AIO 实机则与 Web-BLE / 厂商 App 一致，仅执行 1F1F。
+    未知或读不到 DIS 版本时保留既有 331F 行为，避免回归已验证的 PP 设备。
+    """
+    revision = (firmware_revision or "").strip().upper()
+    if revision.startswith("HM42_AIO"):
+        return RXTX_CHAR_UUID_LEGACY
+    return RXTX_CHAR_UUID
+
 MODES = {
     **{f"image{i}": bytes([0xE1, 0x00, 0x00 + i]) for i in range(4)},
     "calendar1": bytes.fromhex("e10103"),